You can create self-signed service or non-service certificates in NSX Manager. You can also import a signed certificate for NSX-T Data Center-generated CSRs.